Wireshark-users: Re: [Wireshark-users] No interfaces, no /dev directory (MacOS X)
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 6 Sep 2011 00:13:44 -0700
On Sep 5, 2011, at 10:03 PM, Steven Ross wrote:

> Thanks for the explanation of the /dev directory. Confirmed everything you said and it does show there /dev/bpf0 to /dev/bpf6.

bpf6?  Initially, only 5 BPF devices are created; if they're all busy, the BPF driver will create more - but they won't get their ownership or permissions changed automatically.  (Ideally, there would be a /dev/bpf cloning device, so only it would need to have its ownership and permissions changed, and libpcap would just open that to get a new BPF instance, but nobody's made a cloning BPF device yet.)

> So, it looks like it meets the requirement you mentioned, doesn't it?

Yes.

	1) What does the command "id" print?

	2) What does the command "ls -l /dev/bpf*" print?